QRadar: Restarting an application fails with error "An error occurred while registering app instance with id xxxx with QRadar"

Troubleshooting

Problem

Administrators who try to restart an application by using the qappmanager utility can receive the error: "An error occurred while registering app instance with ID xxxx with QRadar".

Symptom

Users opening the applications in the user interface can see errors such as "404 page not found" or "Bad Gateway". The following screen capture shows the Log Source Management App not opening and requesting to be downloaded despite the application being already installed on the system.

Cause

A new installation of the application keeps the zip_source_file_path of the previous installation records. The issue occurs after several reinstallation attempts.

Environment

7.4.0 and later

Diagnosing The Problem

By using the qappmanager utility, display the application status and attempt to start it. The following screen capture shows an example of the Log Source Management application in ERROR state after trying to start it.

Log in to the QRadar Console CLI as the root user.
Run /opt/qradar/support/qappmanager to restart the application.
1. Select option 24 to change the application status to STOPPED.
```
App instance - stop > Choose app instance ID: 1051

Changing app instance 1051 status to STOPPED
```
2. Select option 23 to change the application status to RUNNING.
```
App instance - start > Choose app instance ID: 1051

Changing app instance 1051 status to RUNNING
```
  Output Example:
Run the following command to check the path of the application in the installed_application table.
```
psql -U qradar -c 'select id,name,zip_source_file_path from installed_application;'
```
In the following output, we see the zip_source_file_path column with a different application path for the QRadar Log Source Management application.

Resolving The Problem

To resolve this problem, administrators must manually change the wrong path of the conflicting application to the correct path in the pertinent tables in the database. If you are not comfortable enough to run the commands that modify the tables in the database, contact QRadar Support for assistance.

Note: In this article, the conflicting application is QRadar Log Source Management, which has the ID 1051.

Update the zip_source_file_path column of the conflicting application in the installed_application table.

Create the backup directory.
```
mkdir -pv /store/IBM_Support/
```

Back up the required table.

pg_dump -U qradar -t installed_application --inserts -f /store/IBM_Support/installed_application.sql-bck$(date +%F)

Update the zip_source_file_path column.

psql -U qradar -c "update installed_application set zip_source_file_path = '/store/qapp/xxxx/xxxx.zip' where id=xxxx;"

Output example:

psql -U qradar -c "update installed_application set zip_source_file_path = '/store/qapp/1051/1051.zip' where id=1051;"

Confirm the path was changed correctly.

psql -U qradar -c 'select id,name,zip_source_file_path from installed_application;'

Output example:
Imagen5

Run /opt/qradar/support/qappmanager to restart the application.
1. Select option 24 to change the application status to STOPPED.
```
App instance - stop > Choose app instance ID: 1051

Changing app instance 1051 status to STOPPED
```
2. Select option 23 to change the application status to RUNNING.
```
App instance - start > Choose app instance ID: 1051

Changing app instance 1051 status to RUNNING
```
Result

The application was restarted successfully by using the qappmanager utility. If the application was not restarted successfully after the steps in this technote are run, contact QRadar Support for assistance.

Related Information

QRadar: Basic App Troubleshooting Before Opening a QRadar Support Ticket

QRadar: About the qappmanager support utility

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.0;and future releases"}]

Tips